[interpreter] Fix profiler when hitting OSR frame.

This fixes the runtime profiler to no longer assume that seeing an
optimized frame on the stack implies the underlying function is not
being interpreted when entered normally. This no longer holds with code
generated for OSR directly from bytecode (not installed on function).

R=rmcilroy@chromium.org
TEST=mjsunit/regress/regress-crbug-632800
BUG=chromium:632800

Review-Url: https://codereview.chromium.org/2208603005
Cr-Commit-Position: refs/heads/master@{#38360}

src/runtime-profiler.cc

@@ -264,7 +264,8 @@ void RuntimeProfiler::MaybeOptimizeFullCodegen(JSFunction* function,
   }
 }
 
-void RuntimeProfiler::MaybeBaselineIgnition(JSFunction* function) {
+void RuntimeProfiler::MaybeBaselineIgnition(JSFunction* function,
+                                            bool frame_optimized) {
   if (function->IsInOptimizationQueue()) return;
 
   SharedFunctionInfo* shared = function->shared();
@@ -276,10 +277,11 @@ void RuntimeProfiler::MaybeBaselineIgnition(JSFunction* function) {
   if (FLAG_ignition_osr && FLAG_always_osr) {
     AttemptOnStackReplacement(function, AbstractCode::kMaxLoopNestingMarker);
     // Fall through and do a normal baseline compile as well.
-  } else if (function->IsMarkedForBaseline() ||
-             function->IsMarkedForOptimization() ||
-             function->IsMarkedForConcurrentOptimization() ||
-             function->IsOptimized()) {
+  } else if (!frame_optimized &&
+             (function->IsMarkedForBaseline() ||
+              function->IsMarkedForOptimization() ||
+              function->IsMarkedForConcurrentOptimization() ||
+              function->IsOptimized())) {
     // Attempt OSR if we are still running interpreted code even though the
     // the function has long been marked or even already been optimized.
     int64_t allowance =
@@ -304,7 +306,8 @@ void RuntimeProfiler::MaybeBaselineIgnition(JSFunction* function) {
   }
 }
 
-void RuntimeProfiler::MaybeOptimizeIgnition(JSFunction* function) {
+void RuntimeProfiler::MaybeOptimizeIgnition(JSFunction* function,
+                                            bool frame_optimized) {
   if (function->IsInOptimizationQueue()) return;
 
   SharedFunctionInfo* shared = function->shared();
@@ -316,10 +319,11 @@ void RuntimeProfiler::MaybeOptimizeIgnition(JSFunction* function) {
   if (FLAG_ignition_osr && FLAG_always_osr) {
     AttemptOnStackReplacement(function, AbstractCode::kMaxLoopNestingMarker);
     // Fall through and do a normal optimized compile as well.
-  } else if (function->IsMarkedForBaseline() ||
-             function->IsMarkedForOptimization() ||
-             function->IsMarkedForConcurrentOptimization() ||
-             function->IsOptimized()) {
+  } else if (!frame_optimized &&
+             (function->IsMarkedForBaseline() ||
+              function->IsMarkedForOptimization() ||
+              function->IsMarkedForConcurrentOptimization() ||
+              function->IsOptimized())) {
     // Attempt OSR if we are still running interpreted code even though the
     // the function has long been marked or even already been optimized.
     int64_t allowance =
@@ -399,13 +403,12 @@ void RuntimeProfiler::MarkCandidatesForOptimization() {
 
     Compiler::CompilationTier next_tier =
         Compiler::NextCompilationTier(function);
-    if (frame->is_interpreted()) {
+    if (function->shared()->HasBytecodeArray()) {
       if (next_tier == Compiler::BASELINE) {
-        DCHECK(!frame->is_optimized());
-        MaybeBaselineIgnition(function);
+        MaybeBaselineIgnition(function, frame->is_optimized());
       } else {
         DCHECK_EQ(next_tier, Compiler::OPTIMIZED);
-        MaybeOptimizeIgnition(function);
+        MaybeOptimizeIgnition(function, frame->is_optimized());
       }
     } else {
       DCHECK_EQ(next_tier, Compiler::OPTIMIZED);

src/runtime-profiler.h

@@ -26,15 +26,12 @@ class RuntimeProfiler {
  private:
   void MaybeOptimizeFullCodegen(JSFunction* function, int frame_count,
                                 bool frame_optimized);
-  void MaybeBaselineIgnition(JSFunction* function);
-  void MaybeOptimizeIgnition(JSFunction* function);
+  void MaybeBaselineIgnition(JSFunction* function, bool frame_optimized);
+  void MaybeOptimizeIgnition(JSFunction* function, bool frame_optimized);
   void Optimize(JSFunction* function, const char* reason);
   void Baseline(JSFunction* function, const char* reason);
 
-  bool CodeSizeOKForOSR(Code* shared_code);
-
   Isolate* isolate_;
-
   bool any_ic_changed_;
 };
 

test/mjsunit/regress/regress-crbug-632800.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --ignition --ignition-osr --turbo-from-bytecode
+
+function osr() {
+  for (var i = 0; i < 50000; ++i) Math.random();
+}
+osr();